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27 December 1978 


wenonanou For: [7 STAT 
ier, community security Group 
PROM: a 
Community Security Group STAT 


SUBJECT: Community aspects of DCI approved CIA 
security recommendations 


REFERENCE: Your memo dated 12 Dec. 1978, Subject: 
Revision of compartmentation programs. 


1. This provides my comments on Intelligence Community 
aspects of the DCI approved recommendations on CIA security 
programs. This responds to referenced memorandum. 


2. I see the following individual recommendations from 
the CIA package as being of actual or potential applicability 
to the Community. A plan of action is provided for those 
recommendations which I believe should be followed up on by 
the Security Committee. 


a. Recommendation 4 - I strongly agree that re- 
investigation at the end of a probationary period is 
a very sound security objective for all Community person- 
nel with access to classified intelligence information. 
But what works for CIA may not necessarily be applicable 
to other Community agencies. Questions to be dealt with 
in that regard include duration of probationary period 
for employees in other agencies; extent of rights of 
such employees to conversion to career status; and 
degree to which Civil Service rules permit security 
considerations to govern. the continued employability of 
a person. I recommend that the Personnel and Industrial 
Branch be tasked to explore these questions. If such 
exploration indicates opportunity for us to provide 
guidance to the Community, I would recommend that the 
same branch be tasked to develop a reinvestigation 
proposal for Community implementation. I would suggest 
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that the package provide for a strict timetable requir- 
ing that probationary employees be the subjects of a 
fitness report completed not less than 120 days prior 

to the end of their probationary period; and that the 
immediate supervisor of each such employee be interviewed 
by counterintelligence/investigative personnel on or 
about the same time with regard to employee behavior 

and conduct with emphasis on suitability indicators, 
attitude towards agency administrative rules, and degree 
of compliance with security requirements. I would 
further suggest that, depending on the period of time 
between the employee's EOD and the screening program 
addressed here, that at least a check of FBI records 

and of the police department which covers the area of 
employee residence be made to identify any pertinent 
data. When a probationary period is at least two years 
long, I would suggest that a partial reinvestigation 
covering more than the FBI and police checks above be 
completed. The scope of such reinvestigation should 

be governed by the findings of the DCID 1/14 study. 
Finally, I would recommend that the employee fitness 
reports, supervisory interview results, and reinvestiga- 
tion data be screeened by an agency board chaired by an 
experienced security officer and including representation 
from the agency's personnel office, the employing com- 
ponent, and, where applicable, other elements such as 
medical staff. I would suggest that the primary recom- 
mendation on continued employment in a position involving 
access to classified intelligence be made by the security 
officer, with any dissents by the other representatives 
being filed concurrently. Decision on such recommendation 
should be made by a senior agency official designated 

by the SIO involved. Since only CIA and NSA have authority 
to use the polygraph, there is no point in mentioning 

it for agencies other than NSA. I would recommend that 
NSA be encouraged to use the polygraph in screening 
probationers. 


b. Recommendation 5 - I support the objective of 
better investigative coverage of industrial contractor 
employees with access to classified intelligence in- 
formation. However, some questions need to be answered 
before a proposal to that end is submitted to the Intel- 
ligence Community. First, to what extent does £.0. 10865 
preempt any authority the DCI may wish to exert in this 
area? (That Order generally puts industrial security 
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matters under the jurisdiction of the Department of 
Defense.) Second, hadn't we better get the results 

of the DCID 1/14 survey for use as a base before we 
develop proposed industrial personnel security standards? 
Third, shouldn't we make a rough estimate of the costs 

of our proposal. before we send it out to see that it 

is economically realistic to the point where it will 
receive a proper hearing? I recommend that these matters 
be referred to the Personnel and Industrial Security 
Branch for resolution, and subsequent development of a 
proposal for Community consideration. 


c. Recommendation 13 - I strongly support this 
objective. The criteria needed for use in identifying 
what qualifies for what level of classification will 
be influenced by the efforts of the [____]| Group. 25X1 
Fundamentally, this matter involves DCI guidance to the 
Community for the implementation of E.0. 12065. The 
classification guide approach inherent here is likely 
to meet the same objections as was the case for our 
earlier efforts rs subcommittee. Not- STAT 
withstandin I_ recommend we proceed vigorously as soon 
as a have some draft criteria. That 
part of the CIA recommendation calling for strict 
accountability for all Top Secret material could serve 
well as leading the Community to meaningful acceptance 
of the basié criteria. If the DCI directed strict 
controls for all Top Secret documents, there would be 
a strong incentive to limit the amount of material 
classified at that level. I recommend that this matter 
be referred to the Compartmentation Branch for prepara- 
tion of proposed Community guidance and policy. 


d. Recommendation 14 - same comments and recom- 
mendation as for number 13. 


e. Recommendation 15 - This is readily applicable 
to the Community as written. A good vehicle for promul- 
gating this as policy would be when the [___ |Group STAT 
recommendations are published. I recommend that this 
matter be referred to the Compartmentation Branch. 


f. Recommendation 16 - The CIA recommendation was 
overtaken by E.O. 12065 which requires (Section 5-404(d)) 
agencies to establish programs to encourage and deal with 
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challenges by "agency personnel." The implementing 
directive for the E.0. elaborates on this (Section V). 
What I believe we should consider for the Community 

is DCI policy providing for challenges throughout the 
Community (e.g., making it possible for a DIA analyst 

to challenge a. CIA classification). The risk in this 

is that the Security Committee staff could well end up 
holding the bag in terms of monitoring and supporting 

the challenge system. .I recommend that the Compartmenta- 
tion Branch be tasked to reveiw this matter in the light 
of findings by the[ _]Group. STAT 


g. Recommendation 17 - I don't see this as 
meaningfully applicable to the Community until and unless 
we can show that there is a clear need for such in agencies 
other than CIA. I recommend we not pursue this further 
at this time. 


h. Recommendation 19 - This strikes me as better 
meriting follow-up than recommendation 17. I recommend 
that the Compartmentation Branch be tasked to survey the 
Community to determine if there is a need for standardized, 
formal training as indicated in the CIA paper. If the 
answer is yes, then the same branch should be tasked to 
develop a proposal for DCI issuance (perhaps with assistance 
from the Security Awareness Working Group on proven means 
of getting people's attention with a necessary security 
message). 


i. Recommendation 21 - This is a laudable objective, 
but one which may be more than a little difficult to 
enforce for senior levels which normally have the most 
sensitive information. There is a cost benefit to such 
action as well, arising from precluding the use of office 
copiers for large quantities of personal papers. There 
are negative costs involved in dedicating personnel to 
operate such machines (e.g., if an operator isn't available 
when a "rush" job comes along, users are going to look 
for shortcuts) and keep the necessary records, etc. I 
Suggest we move carefully in this area, first attempting 
to identify where the Community is with regard to controls 
over reproduction. I recommend that a new working group 
of the SECOM be established to explore this subject and 
prepare recommendations for action. 
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yj. Recommendation 22 - This amplifies recom- 
mendations No. 13 with specifics on how documents should 
be controlled and accounted for. I question whether this 
is a realistic goal for the Community given the need of 
analysts, managers and policy personnel to have direct 
access at their desks to controlled documents. Perhaps 
the way to deal with that would be to require that all 
controlled documents disseminated for immediate use be 
returned to registries 90 days after receipt and there- 
after used only in registries or charged out on receipts 
with short due dates. Since this goal would be affected 
by the availability of reproduction facilities, etc., I © 
recommend that this issue be explored and dealt with by 
the same working group suggested in subparagraph "i" 
above. 


k. Recommendation 23 - This relates closely to 
recommendations 13 and 14. This is a good objective, but 
it is highly doubtful that it can be meaningfully applied 
to the vast body of existing SCI classified at the Top 
Secret level. Perhaps a grandfather clause will be 
needed. A spot inventory of a relatively small percentage 
of existing documents would be useful_and practicable, 
however. While the findings of the[ ___|Group will affect 
our action on this matter, I would recommend that the STAT 
working group suggested above be tasked to deal with 
this as well as the related issues of document control 
(perhaps we could call it the SECOM Document Control 
Working Group?). 


1. Recommendation 25 - I defer to the Computer 
Security Subcommittee for suggestions on this. 


3. In terms of priority of effort, I believe we must 
give first attention to those areas which have been tasked 


STAT to the Group or which are clearly affected by what 
that group does. 


STAT 
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